SIMS ID and Passwords

[BenMottram]

Guys

 

Last week I had a bit of an issue which I raised through our LA tech support to ESS. The issue is un-important however part of the offical ESS response was, err, interesting.

 

whereas users, when re-setting an expired password, have to adhere to a stricter password policy that does not allow them to use anything similar to a previous password. The example he gave was changing RedHouse46! to HouseRed46! or W@termelon24 to W@termelon25.

 

This implies that SIMS ID has access to the plain text password history for a user, which either means the passwords are stored using reversible encryption or they are stored as plain text,

The former is just sloppy and about as much use as the proverbial chocolate fireguard (Base64, ROT-13 - looking at you guys), the latter farcical and typical SIMS I guess.

 

Am I just being caffiene deprived and missing something obvious or are ESS just not very bright?

[mbedford]

It may just be guidance, rather than something that they are able to ascertain, there is a possibility that it would allow you to change it to something similar "password1" becomes "password2" for example. Its bad practice and should be discouraged.

 

You are correct in your concerns though, have you raised it with them?

[BenMottram]

It may just be guidance

Hmmm... I don't think its guidance from the context - we were dicsussing the difference between an Admin password reset and a user password reset. Admins can change a password to anything and its just fine however users have more restrictions, as described in my quote.

I haven't raised it with ESS, I will re-open the ticket at the LA and ask if I have misunderstood something...

[bobsmith]

I would not be in the least bit surprised.

 

SIMS was written in the 80s ffs.

[BenMottram]

Normally I would blame ParticularlyPathetic rebrand/ExtremelyStupidSoftware/Crapita, however this is SIMS ID we are talking about; something which - thank whomever - hadn't been dreamt of back when SIMS was a baby and is therefore entirely ExtremelyStupidSoftware's pigeon.